US insurance company Assurance America has confirmed a data breach affecting the personal information and driver's license numbers of 6.9 million people, making it the largest known US driver's license information breach this year.
Founded in 1998, AssuranceAmerica provides auto and rental insurance to customers in more than a dozen U.S. states. The leading insurance company handles large amounts of information about prospective insurance customers and motorists, including personal information and state-issued driver's license details. In the wrong hands, driver's license numbers can be used for fraud and identity theft.
In a data breach notification sent to customers seen by TechCrunch, AssuranceAmerica said it discovered a hacker within its computer systems on March 17. The company concluded its investigation on June 15 and discovered that the hackers had stolen customers' names, contact information, and driver's license numbers.
According to the breach notification, the hackers also stole customers' auto insurance policies and accounts, drivers and vehicles, and customer billing details.
The company did not provide details about what other types of personal information was collected.
AssuranceAmerica did not provide a specific cause for the breach, but noted that the hackers “targeted one of the company's employees” and that the company has since “deactivated the compromised credentials.” It is unclear how these credentials were stolen, but past incidents where employee credentials were stolen are believed to be related to the use of password-stealing malware or compromised software.
TechCrunch emailed AssuranceAmerica CEO Joe Skruck and founder Guy Millner with questions about the incident, including whether the company had contact with the hackers or paid the ransom. Neither responded.
According to the Indiana Attorney General's Office's data breach list, AssuranceAmerica lists the breach as affecting 6.99 million people, with notification letters scheduled to go out on July 10th.
A separate copy of AssuranceAmerica's data breach notification, shared by the Maine Attorney General's Office at TechCrunch's request, also lists the number of people affected as 6.99 million. (Maine's data breach portal is currently under review offline after a fraudulent breach disclosure was published on the website last month.)
The incident at AssuranceAmerica follows a spate of data breaches affecting driver's licenses and other forms of identification in recent months. In June, the Texas government announced that hackers had stolen information on at least 3 million driver's license and passport numbers in a data breach that affected the state's parks and wildlife department.
TechCrunch previously reported on several security lapses that resulted in millions of government-issued IDs being compromised, including incidents involving hotel check-in systems, money transfer apps, prison payphone providers, and UK visa services. These data breaches come as governments around the world push to introduce age-verification laws that increasingly require web users to provide identification to prove they are old enough to legally access websites and apps.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.